Sends the caller a link proving their address is theirs.

Sent while the request waits, unlike a password reset: the caller is signed in and knows their own address, so timing reveals nothing, and a down relay is better reported than hidden.

Errors

401 when not signed in, 403 when an API token was used, 404 when this instance has no accounts or sends no mail, 409 when the address is already confirmed, 429 when that address has hit the send limit for the window, 503 when the relay would not take the message.